Security

What type of security threats is Splunk most effective at responding to?

dave_smith
New Member

Hi guys,

Regarding Splunk's SIEM system, what type of threats is it most effective at responding to?

Thank you!

0 Karma

woodcock
Esteemed Legend

That's the beauty; you get to decide! There is a very substantial pool of existing correlation searches that you can enable and if your desired search doesn't exist, you can create it. I guess the bast answer is "correlated attacks" and by that I mean that various things happen in multiple systems close to eachother in time. That is really the power of Splunk/ES.

0 Karma

mrgibbon
Contributor

In essence, It can be taught via SPL and alerting to detect and respond to any threat you wish.
There isnt really any "most effective" as such, as it can do anything you want, and do it consistently well.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...